Upload
others
View
6
Download
0
Embed Size (px)
Citation preview
STAREP is co-funded by:
European
Union
IMPROVING AUDIT QUALITY THROUGH AUDIT OVERSIGHT AND QUALITY ASSURANCE SYSTEMS
Andrei Busuioc, Senior Financial Management Specialist, CFRR, The World Bank
July 31, 2017 - Centara Grand at Central Plaza Ladprao Bangkok
2
The objective of the session is to present and discuss
»the origins, functions, and current challenges of public oversight
of the auditing profession
»the different institutional arrangements for public oversight and
quality assurance, their strengths and weaknesses
»the main activities - using examples of audit oversight and
quality assurance systems from various countries around the
World
3
»Until 2002 – audit profession was self-regulated: professional
bodies developed auditing standards, disciplined their
members, and advertised the quality and benefits of their
members’ audits to the public
»Regulators in the U.S. and elsewhere occasionally intervened to
discipline auditors in particularly egregious cases and
sometimes to induce the profession to strengthen auditing
standards
4
»The modern movement towards public oversight of the auditing
profession began with the wave of corporate financial reporting
scandals starting about 17 years ago in the U.S., Europe, and
Japan.
»Sarbanes-Oxley Act of 2002 followed by the 2006 EU statutory audit directive –
a worldwide consensus - auditors cannot adequately regulate themselves, mainly because they do not have sufficient incentive to do so:
Conflict of Interest
CorruptionMarket
Incentives
5
» Audit firms themselves attempt to assure consistent quality by developing internal
systems of quality control addressing:
(a) Leadership responsibilities for quality within the firm.
(b) Relevant ethical requirements.
(c) Acceptance and continuance of clients and specific engagements.
(d) Human resources.
(e) Engagement performance.
(f) Monitoring.
See ISQC 1
» PAOs – in the past mostly focused on areas of access to the profession and less on QA
6
Creating mechanisms to monitor and improve auditing practices – adequate incentives to push for improvements in the quality and reliability of
corporate reporting
Government authorities may lack capacity and
resources to monitor the quality of corporate
financial reporting directly
Private monitors of corporate reporting may be absent, underdeveloped or
have no appropriate instruments (analysts, bond
rating agencies, financial journalists, institutional
investors)
In many emerging and middle market countries,
most accounting expertise resides in the local auditing profession, including local affiliates of international
network firms
7
An effective system of public oversight may:
> Improve the overall system of financial reporting by sharpening the quality and rigor of audits
and removing the worst performers from the market;
> Enhance public trust in financial reporting and auditing through its work and public profile; and
> Help promote public understanding of auditing and financial reporting through public outreach
Effective independent oversight of auditors adds credibility and value to financial information. In a competitive environment, market use and demand for financial information should then grow.
8
• Enhancing knowledge in the market about the audit function and determinants of audit quality
• Providing more information to the market about the audit quality of particular firms and auditors
• Strengthening incentives, through reporting and enforcement, for firms to improve audit quality
• Removing the worst performers from the market
• Pushing for continuous improvements in practice
Public oversight can bolster the functioning of
the audit market by:
9
Public oversight bodies (POBs) can monitor and improve the quality of auditing by:
• Regularly inspecting the quality control systems that firms have adopted to see if they are effectively designed and implemented
• Regularly inspecting some of the individual audits performed by firms to assess their adequacy
• Developing measures to induce firms to address any deficiencies found in their quality control system
• Conducting investigations and imposing discipline to address the most serious deficiencies, deter other firms from allowing similar deficiencies to occur, and removing from the market those audit firms that cannot or will not conform to professional standards
10
Creating an audit oversight body can do more harm than good if not done properly
Countries that do not have the resources to provide an oversight body with adequate funds or sufficiently experienced and knowledgeable personnel may better focus their resources initially on improving accounting and auditing education, developing professional accountancy bodies, and other priorities, before attempting public oversight of auditing
Audit oversight is a challenging area of regulation to implement properly, and requires significant resources
11
» Auditing complex companies does not involve just following some standard set of procedures and ticking boxes on a checklist
» To be effective, an auditor must use knowledge and experience to • Understand the company’s business and the way it estimates, records, accumulates, and
reports information about its transactions, obligations, and assets
• Identify the specific risks that might cause some of these items to be reported inaccurately for that company, based on how it operates
• Use professional judgement to design and perform tests for the particular company to obtain reasonable assurance that the financial reporting is reliable
• And the auditor must do all of this efficiently, within a reasonable time and at a reasonable cost
» Thus, audit regulators must understand that they are not regulating a routinized activity, in which they could expect to see the same steps and procedures performed every time. This is an enormous challenge for effective regulation.
12
» Auditors must perform their complex function in a limited time and with limited resources
» If regulators force auditors to spend time and resources on activities that do not involve identifying and addressing the real risks of inaccurate financial reporting for the companies they audit, they will have less time and fewer resources to fulfill their real and important function
» A regulator that does not adequately understand modern auditing
might force auditors to spend too much time on unproductive
“compliance” activities such as:
» Satisfying excessive documentation requirements
» Performing formalistic or rote audit procedures
» Creating formalistic quality assurance processes
A misdirected profession will not develop and improve
13
Auditing is one of the most difficult industries to regulate properly. To determine whether the auditor acted with professional competence and reasonable diligence & judgement, the regulator must
• become familiar with the large set of facts about the audited company that the auditor considered (or should have considered)
• identify and understand the procedures the auditor performed to test the company’s financial reporting, as well as the audit firm’s quality assurance programs that impacted the audit
• assess whether those procedures and programs appear reasonable in light of the risks of unreliable reporting that the auditor faced
Only someone highly trained and experienced in auditing can adequately perform this regulatory function. For review of some audits (e.g., financial services, airline, extractives) industry-specialized experience is also needed
14
Must have adequate funding to:
• hire and retain experienced auditors, who have attained at least manager-level in international network firms or equivalent, to do audit quality inspections (which is often challenging due to civil service pay scales)
• retain experts to conduct or assist in review of specialized audits (e.g., financial services)
• conduct complex investigations and disciplinary actions
Also must have:
• leadership with the credibility to command the respect and attention of the profession, reporting companies, other regulators, and stakeholders
• Incentives and accountability for the leadership to devote sufficient time to developing, guiding, and publicizing the oversight body, and communicating to the general public
• mechanisms to obtain regular input and feedback from stakeholders
15
Review of individual audits by an oversight body requires
substantial time, resources, and expertise
Oversight bodies can therefore review only a tiny portion of the
audits performed within their jurisdiction
To be effective, oversight bodies must develop sufficient expertise to identify the
audits that are most likely to pose substantial risk, based on
> the likelihood of audit deficiencies and
>the potential impact on stakeholders
Oversight bodies must also be able to identify whether an audit firm’s internal quality control program is
adequate to help assure competent auditing
16
• Independent of the auditing profession, but informed by the knowledge and expertise of the profession
• Stringent in imposing accountability on auditors, yet sensitive to the role of auditor judgment and the limitations of routine business audits
• Specialized and focused, yet informed and responsive to the evolving needs of a broad community of users of financial information and other stakeholders, including investors, lenders, regulators, corporate board members, financial analysts, and others
As should be apparent, countries face
substantial challenges in structuring, funding, staffing, and operating
effective audit oversight bodies. The
body needs to be:
17
EXPERTISE
• Auditing is a highly technical field, and most knowledge and experience resides within the profession
INDEPENDENCE
• An outside and independent body is needed to supervise the profession, but if that body lacks expertise, it may misdirect the profession
18
• A self-standing, separately funded, independent agency
• An office , division, or component of a body with a broader regulatory function, such as a securities regulator
• An office or department within the country’s public administration (e.g. Ministry of Finance)
The audit oversight body could be:
• 19 had created their oversight bodies as separate, independent bodies
• The other 5 housed (some within integrated financial sector regulator, some as part of public administration)
For instance, out of 24 EU member states that reported information about their oversight
bodies to IFIAR in 2014:
19
»In Malaysia the six members of the Audit Oversight Board are
appointed by the Securities Commission Malaysia
»The Certified Public Accountants and Auditing Oversight Board
(CPAAOB) in Japan is an independent regulatory body (council)
established within the Financial Services Agency (FSA),
consisting of one chairperson and one full-time and eight part-
time commissioners. The board members are appointed by the
Prime Minister with the consent of the Diet. The Board
exercises its statutory authority independently from the FSA
https://www.sc.com.my/general-section/audit-overboard/about-us-2/board-members/http://www.fsa.go.jp/cpaaob/english/overview.html
20
»The public oversight function in the United Kingdom's Financial Reporting Council has always been independent
»The public oversight function in the Netherlands has always been part of that country's securities regulator, the Authority for Financial Markets.
»The French audit oversight body, the H3C, was created in 2003 as a high-level independent public authority with direct links to the Minister of Justice and has a working relationship with the combined banking and insurance regulator
»The U.S. PCAOB is established as an independent body, but its budget and significant decisions are subject to review by the securities regulator, the SEC
21
Advantages of a separate, independent body:
• More specialization and focus in its mission and operations may result in better accumulation of knowledge and more informed decision-making. The Board members of a body with a much broader mission may never develop sufficient expertise to adequately guide the audit oversight function
• A single body can ensure that audit oversight remains consistently a top regulatory priority
• A single, dedicated body may be more accountable for results
• In some countries, a separate oversight body may be structured to avoid governmental compensation limits, allowing more flexibility to attract former auditors with the needed skills and experience
22
In countries where there is comparatively little appreciation of the value of a POB, and where there is greater appreciation & public recognition of other regulators, it might make sense at least in the short-term to establish the POB as part of another regulator.
Countries with a relatively small pool of accountants with significant experience of IFRS and derivative financial reporting standards might benefit from combining the POB with other regulators who need and would benefit from such experience as they review their regulated entities’ financial statements.
Separate institutions and regulators require comparatively greater resources in terms of time and funds to establish and maintain infrastructure. Combining regulators may reduce overhead costs.
23
Housing the public oversight body as an office within the
Ministry of Finance or an equivalent may leave it more
vulnerable to political influences, instability, and neglect, particularly in an
environment where government ministers are
frequently reshuffled
The selection of board members for the
oversight body should be structured to favor
relevant experience and competence over political
connections
Terms of board members should be long enough to
allow them to take a more-long term view and to give
some continuity to the board and its activities
Ideally, funding should be insulated from big swings in
state budgetary priorities & free
from undue influence from the
profession
24
Board members should be selected to achieve both competence and independence. Must find board members with
➢ adequate financial sophistication
➢ willingness to devote time and attention
➢ credibility with the profession and the public
Someone on the Board should have in-depth understanding andexperience of the auditing process and/or have a perspective of user offinancial information, or the Board must have a way of seeking advicewith persons with that experience, without compromising itsindependence. This may be particularly challenging in emergingmarkets with a younger audit profession.
25
• Retired professionals such as lawyers
• Former audit professionals
• Former bankers
• Directors or former directors of leading companies
• Representatives of business community
• Former civil servants
Public Oversight Boards at large IFIAR members
typically include:
• representatives of other regulators, departments, or central bank, ex officio
• Academics (university professors, etc.)
In addition, members often
include
26
A POB may establish advisory committees, either for a specific and temporary purpose, or on a standing basis, to assure that its decisions are adequately informed. Use of such committees can also increase stakeholder visibility and support. Consultations should occur in a public and transparent way, to assure there is no appearance of compromise of the Board’s independence. Such bodies might include:
> Representatives from the profession
> Large or institutional investors
> Leading academics
> Financial journalists
27
In an environment where retired audit partners or other former practitioners are not available, and other sources of technical audit knowledge may not be available, it may sometimes be best to begin a Board with some sitting practitioners, who would only command a minority of the voting power, to assure that the Board is adequately informed with knowledge of the auditing profession
As the system matures and develops access to professional knowledge, the Board should become fully independent by removing current practitioners entirely from the decision-making body
28
Globally, there are broadly three approaches with regards to inspecting audit firms in countries with Public Oversight Boards:
• The POB directly inspects auditors of public interest entities and auditors of other entities
• The POB directly inspects auditors of public interest entities and oversees the professional accounting organizations who in turn directly inspect auditors of other entities
• The POB oversees the professional accounting organizations that in turn directly inspect auditors of both public interest entities and other entities.
Locating quality assurance within the POB will render it more independent, but possibly less qualified, depending on how funding and structure are resolved
29
Retaining qualified personnel and levying fees to pay inspectors at market rates may sometimes be easier when the QA function is initially delegated to professional body
• Funding based on fee assessments may be stable/adequate
• No civil-service restrictions on salaries
• Professional body may understand need for experience/other attributes for quality assurance staff
Profession itself may thereby be mobilized to support adequate funding and staffing for the new system.
30
If quality assurance begins with the professional body, the independence of the QA function can be enhanced through measures such as required POB involvement and approval for:
• Hiring, firing, promotion and compensation of inspectors;
• Planning of inspections and inspection reporting;
• Continuous training and development
The inspections team might later be transferred to the POB
31
To be effective, every regulatory system must have an enforcement mechanism that can impose serious sanctions for failure to comply, and this certainly applies equally to audit regulation
In addition, a primary function of audit regulation is to remove incompetent or unethical participants from the market
The structure of enforcement systems is heavily dependent on national law and the legal environment
An effective enforcement system will need to have:
• Sufficient resources to investigate complex fact patterns
• Access to expertise about auditing and quality-control standards
• A fair and independent process for charging and adjudication
32
»IFIAR specifies 11 core principles of public oversight systems
arranged around three themes:
The structure of audit oversight:
Principle 1: The responsibilities and powers of audit regulators
should serve the public interest and be clearly and objectively stated
in legislation
Principle 2: Audit regulators should be operationally independent
Principle 3: Audit regulators should be transparent and accountable
33
Principle 4: Audit regulators should have comprehensive enforcement powers which include the capability to ensure that their inspection findings or recommendations are appropriately addressed; these enforcement powers should include the ability to impose a range of sanctions including, for example, fines and the removal of an audit license and/or registration
Principle 5: Audit regulators should ensure that their staff is independent from the profession and should have sufficient staff of appropriate competence
Principle 6: Audit regulators should be objective, free from conflicts of interest, and maintain appropriate confidentiality arrangements
Principle 7: Audit regulators should make appropriate arrangements for cooperation with other audit regulators and, where relevant, other third parties
34
Principle 8: Audit regulators should as a minimum, conduct recurring inspections of audit firms undertaking audits of public interest entities in order to assess compliance with applicable professional standards, independence requirements and other laws, rules and regulations
Principle 9: Audit regulators should ensure that a risk-based inspections program is in place
Principle 10: Audit regulators should ensure that inspections include effective procedures for both firm wide and file reviews
Principle 11: Audit regulators should have a mechanism for reporting inspections findings to the audit firm and ensuring remediation of findings with the audit firm
35
Identifying and rooting out the worst auditors, who
undermine the audit market, the profession, and the
public’s trust
Using inspections and enforcement as capacity-
building tools
Strengthening the market for audit services to focus more on audit quality and
gradually realigning the incentives of the auditing
profession
Serving as a “thought leader” in the
development and use of auditing services
36
»What role do you think audit oversight could play for your country in supporting economic development and integration with other markets?
»Which stakeholders can be enlisted to support public oversight? Which might resist? What can be done to gain their support?
»What would an ideal board look like in your country? What challenges do you see in recruiting the right people to serve on your board?
»Should your board be part of another agency/department, or separate?